The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes user-authored documentation such as product.md and feature specs which may contain malicious instructions designed to influence the agent.
Ingestion points: scripts/audit_product.py, scripts/check_features.py, and scripts/load_product_context.py read local project files.
Boundary markers: The skill implements a robust defensive wrapper in scripts/_untrusted_doc.py that encloses external content in <<<UNTRUSTED_PROJECT_DOC>>> tags, instructing the agent to treat the content as data only.
Capability inventory: The skill is capable of writing markdown files and JSON matrices to the .heyeddi/ directory and executing specific internal Python scripts.
Sanitization: Untrusted content is delimited and explicitly labeled in the prompt, following industry best practices for mitigating indirect prompt injection.
[COMMAND_EXECUTION]: The scripts/verify_product.py script executes other Python scripts as sub-processes to perform automated product audits.
Evidence: Uses subprocess.run to invoke audit_product.py and check_features.py.
Defense: The script employs a strict, hardcoded allowlist (_ALLOWED_SCRIPTS) and validates that scripts reside within the skill's own directory structure. This prevents the execution of arbitrary commands or user-supplied script paths.

heyeddi-product